Users could accidentally burn() and lose fund

Lines of code Vulnerability details Impact If users accidentally burn the token, the fund will be lost. There does not seem any reason for the users to call the public burn function, only by mistake calling the method to lose self fund. Proof of Concept // contracts/enforcer/HolographERC721.sol...

Minimum balance requirement for payout

Lines of code Vulnerability details Impact Payouts from PA1D.sol cannot be made unless the balance is sufficiently high, meaning Proof of Concept In PA1D.sol the payout functions payoutEth, payoutToken and payoutTokens require that balance 10000. If this is not met the recipients cannot receive...

Missing support of non-standart ERC20

Lines of code Vulnerability details Vulnerability details Description In functions of PA1D and HolographOperator contracts there is logic relying on the fact that tokens implemented ERC20 standard especially, that transfer and transferFrom functions of the tokens returns bool result. But in...

Insufficient validation in enforcer's OnERC20Received() callback may lead to loss of funds in implementations.

Lines of code Vulnerability details Description HolographERC20's onERC20Received is presumably a callback that is called when the Holographer receives tokens. Its implementation is: if isEventRegisteredHolographERC20Event.beforeOnERC20Received requireSourceERC20.beforeOnERC20Receivedaccount,...

Anyone can steal all the non-fee balance in LBPair.sol

Lines of code Vulnerability details Proof of concept When a user wants to execute a directswap tx, the way to check the tokens that he put in for the swap is by this code uint256 amountIn = swapForY ? tokenX.receivedpair.reserveX, pair.feesX.total : tokenY.receivedpair.reserveY, pair.feesY.total;...

No check transferFrom() return value

Lines of code Vulnerability details Impact The smart contract doesn’t check the return value of token.transferFrom, some erc20 token might not revert in case of error but return false. Proof of Concept as seen in several contests, for ex: Tools Used Visual inspection Recommended Mitigation Steps...

USE SAFEERC20 (SAFEAPPROVE/SAFEMINT/SAFETRANSFERFROM) INSTEAD OF APPROVE/MINT/TRANSFER FROM

Lines of code Vulnerability details Impact The classic openzepplin implementation of the ERC20 standard ie. functions : Approve, Transfer, TransferFrom and mint does not capture the fact that some ERC20 token do not return a boolean value eg. BNB, USDT, OMG. As results, these functions won't work...

# ERC20 transfer / transferFrom with not checked return value

Lines of code Vulnerability details ERC20 transferFrom with not checked return value Impact Not every ERC20 token follows OpenZeppelin's recommendation. It's possible inside ERC20 standard that a transferFrom doesn't revert upon failure but returns false. Proof of Concept ERC20 transferFrom...

[NAZ-M3] Use safeTransfer()/safeTransferFrom() instead of transfer()/transferFrom()

Lines of code Vulnerability details Impact It is a good idea to add a require statement that checks the return value of ERC20 token transfers or to use something like OpenZeppelin’s safeTransfer/safeTransferFrom unless one is sure the given token reverts in case of a failure. Failure to do so wil...

Use OpenZeppelin's safeTransferFrom instead of transferFrom when transferring ERC20 tokens

Lines of code Vulnerability details Impact In this case, since GRT token is used, the current implementation of GRT does have a return value for transferFrom and reverts on failure, but the same cannot be said for many other ERC20 tokens in the wild. OpenZeppelin recommends to always use...

UNSAFE USAGE OF ERC20 TRANSFERFROM

Lines of code Vulnerability details Impact Ignores return value from L1GraphTokenGateway.finalizeInboundTransfer and L1GraphTokenGateway.outboundTransfer Not tracking values returned by token transfer from. finalizeInboundTransfer When escrow not approve for L1GraphTokenGateway or allowance is no...

Use safeTransferFrom instead of transferFrom()

Lines of code Vulnerability details Impact Although ERC20 standard suggests that a transfer should return true on success, there are tokens that doesn't comply with this. Therefore, the transferFrom call might cause silent failures and will affect the token accounting in this contract. Proof of...

Reentrancy

Lines of code Vulnerability details Reentrancy in BlurExchange.executeInput,Input contracts/BlurExchange.sol128-175: External calls: - executeFundsTransfersell.order.trader,buy.order.trader,sell.order.paymentToken,sell.order.fees,price contracts/BlurExchange.sol147-153 -...

The protocol doesn't support fee-on transfer tokens

Lines of code Vulnerability details Impact There are ERC20 tokens that may make certain customizations to their ERC20 contracts. One type of these tokens is deflationary tokens that charge a certain fee for every transfer functions. So if the implementing contract doesn't takes this fee into...

fake flash loan can grief the pool

Lines of code Vulnerability details there is a scenario where an attacker/griefer can use flash function and trick the pool to think he has paid the flash and the fee while he was only paying back the flash. about double/multiple erc20 tokens : some erc20 tokens have multiple entry points . those...

AlgebraPool ERC20 Tokens with fee on transfer are not supported

Lines of code Vulnerability details AlgebraPool ERC20 Tokens with fee on transfer are not supported Vulnerability details There are ERC20 tokens that charge fee for every transfer / transferFrom. TransferHelper.safeTransfer relies on ERC20.transfer AlgebraPool.solswap assumes that the received...

ArtGobbler can be abused to squirt more goo without providing any NFT

Lines of code Vulnerability details Impact Some ERC20 tokens don’t throw but just return false when a transfer fails. This can be abused to trick the gobble function to gobble without providing any valid art. A good example of such a token is ZRX: Etherscan code This issue can be abused by a...

Possible lost msg.value

Lines of code Vulnerability details In call submit can will send value and the asset can be an ERC20!= address0, if frxETHMinter.sol contract receive this call the fouds will lost. Recommended Mitigation Steps In frxETHMinter, submit function: Check if the msg.value is zero when the asset is...

[H1] Owner of frxETHMinter can rug pull the contract

Lines of code Vulnerability details Impact Owner of the contract is able to leave with all the tokens and ETH of the contract, which makes protocol trustless PoC You have implemented a function to function recoverEtheruint256 amount external onlyByOwnGov bool success, = addressowner.call value:...

Recovererc20 uses transfer -> token transfers do not verify that the tokens were successfully transferred (safeTransfer)

Lines of code Vulnerability details Impact Some tokens do not revert the transaction when the transfer function fails or return false. Which requires us to check the return value after calling the transfer function. Given that recoverERC20 can accept any tokens. A token such as ZRX would not reve...